#opangel

Photo: Marcie Casas/Flickr

Culminating a two-week trial in which no hacking in the traditional sense occurred, a California man was convicted Wednesday under the same hacking statute internet sensation Aaron Swartz was accused of before he committed suicide in January.

Defendant David Nosal was convicted by a San Francisco federal jury on all six charges ranging from theft of trade secrets to hacking, despite him never breaking into a computer. Nosal remains free pending sentencing later this year, when he faces a potential lengthy prison term.

Nosal, a middle-aged man wearing a dark suit, sat stone faced as a clerk read “guilty” on all counts. Jurors deliberated for little more than two days.

After U.S. District Judge Edward Chen dismissed the 12-member jury, Nosal’s defense team demanded a hearing to urge the judge to set aside the verdict. A hearing was set for later this year.

“We think, legally, these counts can’t stand,” Steven Gruel, a Nosal lawyer, said outside the courtroom. Prosecutors declined comment.

Nosal’s prosecution was a novel application of the Computer Fraud and Abuse Act, the same statue Swartz was accused of violating when he allegedly breached security controls of an MIT database and downloaded millions of JSTOR academic articles. After Swartz’s death, the case set off calls across the nation to reform the 1984 hacking law and perhaps even reduce the 5-year terms each violation carries.

But unlike Swartz, Nosal never was accused of traditional hacking. Among other things, what the jury concluded was that he coaxed, sometimes through monetary payments, his former colleagues at Los Angeles-based executive search firm Korn/Ferry International to access the firm’s proprietary database and provide him with trade secrets to help him build a competing firm. Those associates cooperated with the government and were not charged.

The Computer Fraud and Abuse Act was passed in 1984 to enhance the government’s ability to prosecute hackers who accessed computers to steal information or to disrupt or destroy computer functionality.

The act makes it a federal offense if one “knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value, unless the object of the fraud and the thing obtained consists only of the use of the computer and the value of such use is not more than $5,000 in any 1-year period.” Prison penalties are up to 5 years per violation.

Nosal’s case has had a lengthy history, with two trips to the San Francisco-based 9th U.S. Circuit Court of Appeals. A third trip is likely and perhaps the Supreme Court might weigh in to set boundaries around how far the government may go in prosecuting so-called hacking.

The 9th U.S. Circuit Court of Appeals, ruling in Nosal’s case for a second time last year, decided that employees may not be prosecuted under the anti-hacking statute for simply violating their employer’s computer use policy. The appeals court had tossed several charges against Nosal stemming from when he was a still a Korn/Ferry employee, in which he was accused of using his work credentials in 2005 to access his employer’s database to help build a competing business for himself.

To be sure, the government indeed levies charges under the anti-hacking statute targeting traditional hackers. Two California men, for example, were sentenced between two and four years Monday in an extortion scheme stemming from the hacking of e-mail accounts of professional poker players.

But clearly, you don’t have to be a hacker to be charged as one.

An online social media editor for the Reuters news agency, for example, was indicted last month for allegedly helping members of Anonymous hack another media organization’s network.

Summary: The U.S. Sentencing Commission website has been hacked a second time. A code distributed by Anonymous "Operation Last Resort" turns ussc.gov into a game of Asteroids.

-

The U.S. Sentencing Commission website has been hacked again and a code distributed by Anonymous "Operation Last Resort" turns ussc.gov into a playable video game.

Visitors enter the code, and then the website that sets guidelines for sentencing in United States Federal courts becomes "Asteroids."

Shooting away at the ussc.gov webpage reveals an image of Anonymous.

The trademark Anonymous "Guy Fawkes" face is comprised of white text saying, "We do not forgive. We do not forget."

Update Sunday, January 27, 11pm PST: the ussc.gov website has been offline intermittently, ostensibly due to high traffic. Anonymous Operation Last Resort tweeted the Asteroids hack can be "played" on yet another U.S. government website: "Backup gaming site while USSC.gov  is down miep.uscourts.gov " (the U.S. Probation Office for the state of Michigan). This suggests, in this writer's opinion, that Anonymous has background control of multiple U.S. government websites - and after the antics this weekend, the group likely has had this access for a while and they are playing a game of cat-and-mouse with the United States Department of Justice.

Gallery: U.S. Sentencing website hacked into video game "Asteroids"

Hacktivist group Anonymous began its "Operation Last Resort" Friday night by hacking the U.S. Sentencing Commission website in the name of suicide victim Aaron Swatrz, demanding reform in the U.S. justice system.

The government website was pulled offline and restored by Saturday. Now, on Sunday afternoon, the U.S. Sentencing Commission website appears to have been compromised a second time, severely, wherein a code being issued by Operation Last Resort and other Anonymous social media accounts turns ussc.gov into a game of Asteroids.

Upon visiting ussc.gov and entering enter Konami code (with cursor keys) ↑↑↓↓←→←→ (up up, down down, left right left right) then keys B, A and "Enter" - the page becomes a playable version of the old Atari game, Asteroids.

Visitors can use their keyboard to shoot away at the U.S. Sentencing Commission website.

The hack reads:

AntiSec CAEK-mode activated. Destroy the system! Controls: up, down, left, right to fire.

Blasting away at the text on the website using the keys CAEK ("repeat for NyanCat powers"), player points tally in a score box in the bottom right of the screen, while the government website page and text begin to shrink.

As the "player" gets points by shooting the U.S. Sentencing Commission website, underneath a dark image of Anonymous is revealed.

This is the second time the website has been attacked and defaced in a hack that involves public participation.

See also: Anonymous hacks US Sentencing Commission, distributes files

Anonymous apparently still somehow has control of the website in some way, despite the last efforts by the U.S. government to clean up the attacks.

The link to the Javascript is embedded in the ussc.gov page, but the script is hosted on a public Google URL.

The website has actually been publicly attacked three times this weekend.

But the second hack was a massive takeover that stuck. Anonymous had used the site to distribute encrypted government files and left a statement on the website that de-encryption keys would be publicly released (thus releasing the as-yet unkonwn information held on the stolen files) if the U.S. government did not comply with Anonymous' ultimatum demands for legal reform.

Anonymous has not specified exactly what files they have obtained. The various files were named after Supreme Court Justices.

However, while the first hack was restored when the U.S. government swiftly acted to wipe the site from its DNS and pull the IP address, and then restore the website, the same resolution may not be possible as it seems Anonymous - and/or AntiSec - still have access.

The U.S. Sentencing Commission sets guidelines for sentencing in United States Federal courts, and Anonymous stated it had chosen the website for symbolic reasons.

Previously on the defaced ussc.gov website Anonymous cited the recent suicide of hacktivist Aaron Swartz as a "line that has been crossed."

The statement suggested retaliation for Swartz's tragic suicide, which many - including the family - believe was a result of overzealous prosecution by the Department of Justice and what the family deemed a "bullying" use of outdated computer crime laws.

See also: Hacker, activist Aaron Swartz commits suicide